IBM CCA programming

Read the information in this part of the document which introduces programming for the IBM® CCA, AES, DES, HMAC, and PKA cryptography.

Programming with the IBM Common Cryptographic Architecture
By using the IBM CCA application programming interface (API), you can obtain cryptographic and other services from the CEX*C feature and CCA.
Running CCA verbs in PCI-HSM 2016 compliance mode
Starting with the Crypto Express6 feature (CEX6S), the IBM Z® cryptographic hardware offers the possibility to run CCA applications using keys that conform to the PIN Transaction Security (PTS) standards of the Payment Card Industry (PCI). This PCI PTS standard implemented on a hardware security module as of June 2016 is referred to in this documentation as PCI-HSM 2016 compliance mode.
Using AES, DES, and HMAC cryptography and verbs
You can use AES, DES, and HMAC cryptographic functions that CCA provides. CCA also provides cryptographic key functions, and you can use CCA to build key tokens.
Introducing PKA cryptography and using PKA verbs
Read the provided introduction to Public Key Algorithms (PKA) and Elliptic Curve Cryptography (ECC). When you use the CCA PKA verbs, take note of these programming considerations, such as the PKA key token structure and key management.
Introduction to TR-31 symmetric key management
The format of a TR-31 key block has been standardized in ANSI X9.143-2022 and was originally defined in ASC X9 TR 31-2018: Interoperable Secure Key Exchange Block Specification.
Understanding and managing master keys
In a CCA node, AES, DES, APKA, and PKA master keys are used to wrap or unwrap working keys. These master keys are also used to wrap or unwrap the object protection keys (OPKs) of the working keys that have an OPK defined. These keys are used by the node and can appear outside of the cryptographic engine, and therefore need wrapping.

Parent topic: Secure Key Solution with the Common Cryptographic Architecture Programmer's Guide